JVNVU#99077347
Multiple vulnerabilities in First Corporation's DVRs

Overview

Digital Video Recorders (DVRs) provided by First Co., Ltd. contain multiple vulnerabilities.

Products Affected

• CFR-904E, CFR-908E, CFR-916E
• CFR-4EHD, CFR-8EHD, CFR-16EHD
• CFR-4EHA, CFR-8EHA, CFR-16EHA
• CFR-4EAAM, CFR-4EABC
• CFR-4EAA, CFR-8EAA, CFR-16EAA
• CFR-4EAB, CFR-8EAB, CFR-16EAB
• CFR-1004EA, CFR-1008EA, CFR-1016EA
• MD-404HD, MD-808HD
• MD-404HA, MD-808HA
• MD-404AA, MD-808AA
• MD-404AB, MD-808AB

Description

DVRs provided by First Co., Ltd. contain multiple vulnerabilities listed below.

• Use of hard-coded password (CWE-259) - CVE-2023-47213

  CVSS v3

  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  Base Score: 8.1

• Missing authentication for critical function (CWE-306) - CVE-2023-47674

  CVSS v3

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  Base Score: 9.8

Impact

A remote attacker may rewrite or obtain the configuration information of the affected device.

Solution

Update the Firmware
The developer provides the firmware updates for the following products.

• CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, MD-808AB: Late model